454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2

Analysis

max time kernel
92s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 00:09

Target

454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe
Size

412KB
MD5

db35d5e536e5ccd7d426fa375e4f4270
SHA1

5a93273c3eb4524c5511db9562a8cd818a354723
SHA256

454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2
SHA512

98e607917bb348f50cb9a19fa1787469b1f6fbb18c6c432671290af33caa43e2d8e1cccf99e089c586a3dcb187b9bea79591e224213ed0cb633cd63b60283725
SSDEEP

12288:pgEujB9E2gl17kYwbTA+C0S0xU7zyvgIRuVu:6lQ+Yw3x2zegvM

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1752-55-0x0000000000400000-0x0000000000530000-memory.dmp	vmprotect
behavioral1/memory/1752-58-0x0000000000400000-0x0000000000530000-memory.dmp	vmprotect
behavioral1/memory/1752-60-0x0000000000400000-0x0000000000530000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 1752 WerFault.exe 454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe

pid	pid_target	process	target process
1280	1752	WerFault.exe	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe

pid	process
1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe
1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe

description	pid	process	target process
PID 1752 wrote to memory of 1280	1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe	WerFault.exe
PID 1752 wrote to memory of 1280	1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe	WerFault.exe
PID 1752 wrote to memory of 1280	1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe	WerFault.exe
PID 1752 wrote to memory of 1280	1752	454734d87e42bea2c8a10d41c1a5b5bde90a8a168c8c9b2e7c6cde87652121d2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 280
2⤵
- Program crash
PID:1280

memory/1280-59-0x0000000000000000-mapping.dmp

Download
memory/1752-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/1752-58-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/1752-60-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download